Outlook OST vs PST Files for Offline Forensics
In an email crime investigation, the forensic investigator analyses a computer using the Microsoft Outlook application. The investigator knows that Outlook stores email data in both .pst and .ost file formats. They want to focus on the files that hold the email data even when there is no internet connection. Which files should the investigator target for a deeper analysis?
Community Votes
100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The question tests knowledge of Outlook storage mechanisms, with the common trap being confusion between OST (cached online profile) and PST (local archive/export).
This question tests the ability to distinguish between Outlook's OST and PST file formats in the context of email forensics. The page establishes that OST files are the correct target for analyzing cached offline data.
Candidates often select PST files because they represent local storage, failing to recognize that OST is the specific format used by Exchange/Online accounts to cache data for offline access.
Community Discussion (4 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The correct answer is A. In Microsoft Outlook, an Offline Storage Table (.ost) file is created when a user configures an Exchange or Microsoft 365 account. This file acts as a local replica of the mailbox on the server, allowing the user to access emails, contacts, and calendar items even without an internet connection. For a forensic investigator, this is the primary location to find recent email activity that was viewed or drafted offline.Why the Other Options Are Wrong
Option D (PST files) stores manually exported or archived emails, not the automatic cache of an online mailbox. Option C refers to AutoArchive settings which move old mail to a PST, but does not describe the real-time offline cache. Option B is irrelevant as it discusses different email clients entirely.Community Comment Notes
The community consensus strongly supports OST. User 'jingu_bingo' referenced CHFI materials confirming OST availability without internet. User 'Elb' noted that OST updates upon reconnection, highlighting its role as a synchronized cache. Another comment explained that OST contains automatically cached emails unlike PSTs.Official Reference
Exam Strategy
Always associate 'Exchange/Online Account' with OST and 'Archive/Export' with PST. When a scenario mentions accessing email 'offline' while still part of a corporate environment, look for OST.
Frequently Asked Questions
Why is PST not the answer for offline access?
PST files are used for archiving or exporting personal folders, whereas OST is specifically designed to cache online mailbox data for offline use.
Where are OST files typically stored?
They are usually found in AppData\Local\Microsoft\Outlook, distinct from PST files which are often in Documents or custom locations.